This specification relates to malware protection software.
Malware is any kind of malicious software such as, for example, a computer virus, Trojan horse, spyware, and malicious active content. Malware can spread via infected email attachments, shared files, or malicious websites. Malware can also spread inconspicuously via link files that cause malicious activities to be performed, such as downloading malware.
Malware can attach to files so that when the infected file executes, the malware also execute and, for example, self-replicates without the user's knowledge or permission. Other malware target a computer's memory and infect files as the computer opens, modifies, or creates files. Some malware can lie dormant and not show any signs of existence, e.g., key capture software, monitoring software, etc. Some malware executes as threads within otherwise legitimate computer processes.
Malware protection software generally operates by scanning a computer's memory and disk drives for malicious code. Scanning may be performed by comparing signatures of files with signatures of known malware. Once identified, the malware may be removed. However, some malware is capable of re-infecting a computer so long as a malware process or thread is executing.